<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
    <title>ShellCheck: SC2060 – Quote parameters to tr to prevent glob expansion.</title>
    <link rel="stylesheet" href="css/bootstrap.min.css" />
  </head>
  <body style="margin-left: auto; margin-right: auto; max-width: 800px">
    <h1>SC2060 – ShellCheck Wiki</h1>
    <a href="https://github.com/koalaman/shellcheck/wiki/SC2060">See this page on GitHub</a>
    <p style="display: none"><a href="index.html">Sitemap</a></p>
    <hr />
    <h1 id="quote-parameters-to-tr-to-prevent-glob-expansion">Quote
parameters to tr to prevent glob expansion.</h1>
<h3 id="problematic-code">Problematic code:</h3>
<div class="sourceCode" id="cb1"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb1-1"><a href="SC2060.html#cb1-1" aria-hidden="true" tabindex="-1"></a><span class="fu">tr</span> <span class="at">-cd</span> [:digit:]</span></code></pre></div>
<h3 id="correct-code">Correct code:</h3>
<div class="sourceCode" id="cb2"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb2-1"><a href="SC2060.html#cb2-1" aria-hidden="true" tabindex="-1"></a><span class="fu">tr</span> <span class="at">-cd</span> <span class="st">&#39;[:digit:]&#39;</span></span></code></pre></div>
<h3 id="rationale">Rationale:</h3>
<p>From the shell's point of view, unquoted <code>[:digit:]</code> is a
glob equivalent to <code>[digit:]</code> that matches any single
character filename from the group, such as <code>d</code> or
<code>t</code>, in the current directory.</p>
<p>If someone starts learning D and creates a directory named
<code>d</code> to hold the source code, the glob will be expanded and
the script will end up executing <code>tr -cd d</code> instead, which is
clearly unintended.</p>
<p>Quoting the argument prevents this, and will pass it correctly as the
literal string <code>[:digit:]</code> no matter which files exist in the
current directory.</p>
<h3 id="exceptions">Exceptions</h3>
<p>None</p>
    <hr />
    <p style='font-size: 80%'><a href="../index.html">ShellCheck</a> is a static analysis tool for shell scripts. This page is part of its documentation.</p>
  </body>
</html>


